The reviewer workflow
Accept / Modify / Reject, the supersede mechanic, and the append-only audit trail — the core promise.
Three actions on every parameter
Each AI-proposed parameter offers exactly three reviewer actions:
- Accept — promotes the proposal as-is. An audit row is written with the reviewer's identity and timestamp.
- Modify — accepts a revised value, with a required reviewer note.
- Reject — marks the value unsuitable, with a required reason. The row is preserved, never silently deleted.
The review screen is a split: the AI proposal on the left, the source page rendered on the right. The reviewer reads the source, then acts; the action writes live to the audit log and the queue advances.
Immutability and supersede
Evidence-grade rows are immutable. A revision does not overwrite — it supersedes:
- the old row is marked
status = superseded, - a new row is written with
status = active, - both are retained forever.
Cost-effectiveness models, budget-impact models, and HTA exports only read active evidence-grade rows.
Authority levels
Configurable per user and tenant:
- Suggest only (default) — nothing enters the evidence base without a signature.
- Auto-promote high-confidence — proposals above ~0.92 confidence promote automatically (a reviewer signature is still recorded).
- Full autopilot — the Wizard runs uninterrupted; a reviewer signature is still required before a value becomes evidence-grade.
The audit trail
Every promote, modify, reject, pipeline run, upload, export, and login is an append-only event: attributable, timestamped, and never editable. See Architecture → the audit invariant for how this is enforced physically at the database role level.
The methodology manifest
For every evidence-grade parameter the manifest renders the full chain:
Source document (page, table)
→ AI extraction (model, confidence, timestamp)
→ Reviewer (name, decision, note)
→ Flowed into (each tool run that consumed it)
→ Tested in (the sensitivity / PSA run)It reports integrity (for example, 64 of 64 fully traced, 0 broken chains) and exports as a PDF appendix plus a machine-readable JSON-LD companion.